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The Exploration Flight Test 1 (EFT-1) mission is the unmanned flight test for the up- 
coming Multi-Purpose Crew Vehicle (MPCV). During entry, the EFT-1 vehicle will trigger 
several Landing and Recovery System (LRS) events, such as parachute deployment, based 
on on-board altitude information. The primary altitude source is the filtered navigation 
solution updated with GPS measurement data. The vehicle also has three barometric al- 
timeters that will be used to measure atmospheric pressure during entry. In the event that 
GPS data is not available during entry, the altitude derived from the barometric altimeter 
pressure will be used to trigger chute deployment for the drogues and main parachutes. 
Therefore it is important to understand the impact of error sources on the pressure mea- 
sured by the barometric altimeters and on the altitude derived from that pressure. The 
error sources for the barometric altimeters are not independent, and many error sources 
result in bias in a specific direction. Therefore conventional error budget methods could 
not be applied. Instead, high fidelity Monte-Carlo simulation was performed and error 
bounds were determined based on the results of this analysis. Aerodynamic errors were 
the largest single contributor to the error budget for the barometric altimeters. The large 
errors drove a change to the altitude trigger setpoint for FBC jettison deploy. 


Nomenclature 


a Altitude, ft 

p Pressure, psia 

< 7 X Standard deviation of random variable x 

/.. l x Mean of random variable x 


I. Introduction 

The Exploration Flight Test 1 (EFT-1) mission is the unmanned flight test for the Multi-Purpose Crew 
Vehicle (MPCV). During entry, the EFT-1 vehicle will trigger several Landing and Recovery System (LRS) 
events, such as parachute deployment, based on on-board altitude information. The primary altitude source is 
the filtered navigation solution updated with GPS measurement data. The vehicle also has three barometric 
altimeters that will measure atmospheric pressure during entry. In the event that GPS data is not available 
during entry, the altitude derived from the barometric altimeter sensed pressure will be used to trigger LRS 
events. Therefore it is important to understand the impact of error sources on the pressure measured by the 
barometric altimeters and on the altitude derived from that pressure. 

The purpose of characterizing the barometric altimeter altitude error budget was twofold: 
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1. Determine whether current LRS trigger setpoints will result in LRS events occurring within acceptable 
ranges given expected barometric altimeter errors; if not, adjust triggers to accommodate expected 
errors 

2. Determine the altitude at which the error in altitude from the barometric altimeters is small enough 
that it may be used to trigger LRS events 

Typically, for error budget calculations it is assumed that all error sources are independent, normally 
distributed variables. Thus, the initial approach to developing the EFT-1 barometric altimeter altitude error 
budget was to create an itemized error budget under these assumptions. This budget was to be verified by 
simulation using high fidelity models of the vehicle hardware and software. However, the simulation results 
did not match the itemized error budget; the errors at higher altitudes in the simulation were much larger 
than those predicted by the itemized error budget, while errors at low altitudes in the simulation were 
smaller than those predicted by the itemized error budget. The discrepancy was caused by the fact that the 
error sources directly affecting sensed pressure also affected the altitude calculated from that pressure in a 
non-linear manner, which then compounded errors due to atmospheric modeling. 

The final error budget accounted for all known error sources and their interactions. These numbers were 
used to assess validity of the current LRS trigger altitude settings in the vehicle flight software when using 
the barometric altimeter altitude to trigger events. 

II. MPCV Design 

The Multi-Purpose Crew Vehicle (MPCV) is NASA’s next-generation space exploration vehicle. A sim- 
plified version of the MPCV will be flown for the EFT-1 mission. During the mission, the vehicle will launch, 
complete two orbits, then perform a high-energy re-entry. This paper will focus on the entry portion of the 
mission. 

II. A. MPCV Flight Hardware Overview 

The EFT-1 vehicle has a small navigation sensor suite consisting of two IMUs, a single GPS receiver, and 
three barometric altimeters. The vehicle will navigate primarily using IMU data aided by GPS measurements. 
A GPS-aided navigation state and an inertial, IMU-only navigation state will be maintained for each IMU. 
There is a possibility that GPS measurements will not be available during entry. In this case, the GPS-aided 
navigation estimates may degrade to the point that altitude calculated from those solutions will not be 
accurate enough to achieve LRS events within acceptable altitude ranges. The barometric altimeters are 
intended to act as a back-up source of altitude in the event of loss of GPS data. Possible causes of loss of 
GPS data include receiver failures as well as failure to quickly regain lock with sufficient satellites following 
the blackout period during re-entry. 

II. B. Barometric Altimeters 

The vehicle has three second generation Precision Pressure Transducer (PPT-2) barometric altimeters manu- 
factured by Honeywell International. The sensors are mounted in the midbay compartment near two passive 
vents. All three sensors are packaged in a single assembly. Figure 1 shows the mounting location of the 
barometric altimeter assembly and a rendering of the passive vents, which allow pressure equalization of the 
midbay compartment. 

The three barometric altimeters output an analog voltage proportional to the sensed pressure. Nominally 
the sensors output 0.1 V at vacuum, and 5 V at maximum pressure. The pressure range of the PPT-2 sensors 
is 0 to 20 psia. 

The analog voltage output by the barometric altimeters is sampled and converted to a digital signal by 
the Analog to Digital Input/Output (ADIO) cards in the Power and Data Units (PDUs). Each PDU has 
one ADIO card. There are two barometric altimeters routed through PDU C3, and one routed through PDU 
C4 to provide redundant paths for altitude data. 

The digitized voltages from all three barometric altimeters are transmitted to both Vehicle Management 
Computers (VMCs) over the Onboard Data Network (ODN). The Flight Software (FSW) on the VMCs 
determines the health of the barometric altimeter digital measurements from the PDUs, filters the voltages, 
and converts them to pressures based on the nominal ranges of the sensors. Each pressure is then converted 
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Figure 1: Barometric altimeter assembly location inside the midbay compartment near passive vents 


to altitude using a curve fit to the Standard76 Atmosphere model. The barometric altimeter Fault Detection, 
Isolation, and Recovery (FDIR) software performs a mid- value select among the valid current measurements. 
The mid- value select algorithm protects against any single undetected failure of a barometric altimeter. The 
selected barometric altimeter altitude is passed to downstream software that selects among the available 
altitude sources: barometric altimeter, GPS-aided navigation solutions, and inertial navigation solutions. 
GPS-aided navigation is the primary source, barometric altimeters are secondary, and inertial solutions are 
the tertiary source. 

The best available altitude is then passed to the Descent and Landing Triggers software, where it can 
be used to trigger GNC and Landing Recovery System (LRS) events. The best available altitude will be 
referred to as the Flight Software (FSW) altitude for the remainder of this paper. 

II. C. Entry, Descent, and Landing Triggers 

Several key events during Entry, Descent, and Landing (EDL) for the EFT-1 mission are triggered based on 
vehicle altitude knowledge. The EDL events and the nominal altitude for each event are shown in Figure 2. 

Each of the key events in Figure 2 has at least two possible triggers in order to ensure the event occurs 
even in the presence of failures. In many cases, the primary trigger is the best available altitude selected from 
the altitude sources. As mentioned above, GPS-aided navigation is the primary altitude source, barometric 
altimeters are secondary, and inertial solutions are the tertiary source. 

There are three possible triggers for FBC parachute deployment: flight software altitude, a velocity 
trigger based on the unaided inertial navigation solutions, and the ’’Smart” FBC jettison logic. If GPS- 
aided navigation or barometric altimeter altitude is available, the FBC parachutes will be deployed when 
either the minimum deployment altitude is reached, or when the FSW altitude is less than the FBC chute 
deployment altitude ceiling and the RSS of the vehicle sensed pitch and yaw rates exceeds a threshold, 
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Figure 2: EFT-1 Entry Events 


whichever is met first. This latter trigger is referred to as the ’’Smart” FBC jettison logic. If the FSW 
altitude source is the unaided navigation solution, the FBC chutes will be deployed when the norm of the 
estimated inertial velocity descends below the velocity trigger threshold. In general, the velocity trigger 
results in early FBC parachute deployment. 

Following FBC parachute deployment, the FBC mortars are fired, the FBC is jettisoned, and the drogue 
parachutes are deployed based on timers initiated upon FBC parachute deployment. Once under the drogues, 
if the source of the FSW altitude is the GPS-aided navigation solution or the barometric altimeters, drogue 
parachute release is initiated when the FSW altitude is below a ceiling value, the required minimum time 
under the drogues is achieved, and the ’’Smart drogue jettison logic allows drogue release. If either of the 
latter two conditions are not reached before a floor drogue release altitude is reached, the drogues are jettison 
regardless of the time under them or the ’’Smart” logic. 

If the source of the FSW altitude is the unaided inertial navigation, the drogue parachutes are released 
after a minimum time under the drogues has been achieved and the ’’Smart” drogue release logic allows 
drogue jettison. If drogue release has not been achieved before a maximum allowable time under the drogues 
has been reached, the drogue parachutes will be released regardless of the dynamic environment. The 
” Smart” drogue jettison logic uses sensed vehicle body rates to detect the amount of oscillation the vehicle 
is undergoing. When the oscillation is within a specified deadband, the smart logic will allow drogue chute 
release. 

Following drogue parachute release, the main parachutes are deployed based upon a timer initiated at 
drogue parachute release. There are two possible modes under the main parachutes: anti- twist control and 
landing orient. The anti- twist control is designed to prevent the vehicle from twisting up the parachute lines 
and reducing the ability of the vehicle control system to properly orient the vehicle at landing. The landing 
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orientation logic ensures the vehicle is pointing toward the correct heading at touchdown. Once the drogue 
parachutes have been jettisoned, a timer is initiated. Once the timer reaches a threshold, if the altitude is 
above the threshold for start of landing orient mode and the altitude source is GPS-aided navigation or the 
barometric altimeters, the control mode is set to anti-twist mode. If the landing orient altitude is met, the 
mode is set to landing orient. If the FSW altitude source is the unaided navigation solution, the transition 
from anti-twist mode to landing orient mode is based on another timer initiated upon drogue parachute 
release. 

Therefore, there are four EDL events triggered directly from on-board altitude estimates when the source 
of the FSW altitude is the GPS-aided navigation solution or the barometric altimeters. When neither of these 
altitude sources is available, other triggers are used. Several GNC and LRS events, such as FBC jettison 
and main parachute deploy, are always triggered based on timers. If GPS-aided or barometric altimeter 
altitude are available, these timers are initiated at the start of events triggered from altitude. Therefore, all 
LRS events are nominally either directly or indirectly triggered based on vehicle altitude. The timers for 
each timed event are set such that these events should occur within a specific altitude range. The nominal 
timeline for LRS events is shown in Figure 3. 


00:00:08 

Initiate FBC jettison 
TIMER 



TIMER 


Figure 3: Nominal timeline of LRS events 


The rest of this paper will focus on the case of nominal triggers based on barometric altimeter altitude, 
and how the barometric altimeter altitude budget affects the setting of the trigger altitudes in the flight 
software. 


III. Simulation Tools 

The Orion Guidance, Navigation, and Control (GNC) team developed a high fidelity Trick 2 -based sim- 
ulation tool called Osiris to be used for GNC analysis. The Osiris simulation models the vehicle sensors 
and effectors as well as environments and vehicle dynamics, and allows for six degree of freedom simulation 
of the vehicle state. The Osiris simulation models the three barometric altimeters, including possible error 
sources. Individual error sources can be enabled and disabled independently. 

A separate prototype flight software simulation called Ramses was also developed as a testbed for GNC 
algorithms. The Ramses simulation contains all guidance, navigation, and control algorithms as well as the 
sensor data processing algorithms and Fault Detection, Isolation, and Recovery algorithms. 

The Osiris simulation can be used to drive the Ramses flight software simulation in a closed-loop manner 
in which Osiris provides the expected sensor data to Ramses, Ramses processes that data and calculates 
effector commands, and the commands are sent back to Osiris, which propagates the vehicle dynamic state 
forward to the next time step. In this manner, the entire mission can be simulated. 

The Osiris-Ramses simulation can be run in Monte Carlo fashion with input dispersions defined in data 
files. Mass properties, sensor errors, effector errors, and ranges of environmental conditions as well as initial 
states can be dispersed. The Monte Carlo capability was utilized in the formation of the barometric altimeter 
error budget. 

The flow of data in the Osiris-Ramses simulation is shown in Figure 4. 
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Figure 4: Flow of barometric altimeter data in the Osiris-Ramses simulation environment 


IV. Barometric Altimeter Altitude Error Sources 

There are four main error sources that cause the barometric altimeter sensed altitude to deviate from 
truth. These error sources are: 

1. Sensor errors 

2. A/D conversion errors 

3. Aerodynamic effects 

4. Atmosphere model errors 

There are other error sources that have a smaller impact on the overall error budget, such as waves and tides 
and data transmission latencies. The following sections discuss the modeling of the major error sources and 
the quantification of their individual contributions to the total error budget. 

V. Itemized Error Budget 

Traditional error budgeting assumes all variables are independent, normally distributed variables. The 
definition of the standard deviation of a random variable x is 

a x = sJVar(x) (1) 

where Var(:r) is the variance of x and is the second moment of random variable x about the mean of x, y. 
The variance is expressed as 

V ar(x) = E[(x — y) 2 ] (2) 

where E{x) is the expected value of x. The joint variance of two random variables x and y is defined as 

Var(x + y) = E[(x - y x ) 2 ] + E[(y - n y ) 2 } + E[(x - y x ) 2 (y - y v ) 2 

= Var(x) + Var{y) + Cov(x,y) (3) 

where Cov(x,y) is the covariance of random variables x and y. If x and y are independent, there is no 
correlation and this term is zero. Therefore the total standard deviation of two random variables x and y is 
given by 

o x+y = \JV ar{x + y) 

= \/Var(x) + Var(y) 

= \j G l + ( 4 ) 

Equation (4) can be expanded to any number of random variables, thus the total error based on the assump- 
tion of independent error sources is the square root of the sum of the squares of the standard deviations of 
the individual error sources, i.e. the RSS of the standard deviations of the individual error sources. 1 For 
error budgets, usually the 3-sigma values and not the 1-sigma values for standard deviation are used. 

The itemized error budget for the barometric altimeters originally assumed all error sources were are 
independent, zero-mean, and normally distributed. However, during the process of characterizing individual 
error sources, it became apparent that some of the individual error sources biased sensed altitude in a specific 
direction, and were therefore not zero-mean. Thus it was decided to add the sources with non-zero mean 
(including the sign of the bias) to the RSS of the zero-mean variables in order to more accurately represent 
the error in the barometric altimeter altitude. The following sections describe the individual error sources 
in detail. 
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V.A. Converting Pressure Errors to Altitude Errors 

With the exception of the atmospheric modeling errors, latency errors, and errors due to waves and tides, all 
of the errors discussed above are expressed in terms of pressure. However, the goal was to define the errors 
in terms of altitude. 

The barometric altimeter FSW converts pressure to altitude using a curve fit to the 1976 US Standard 
Atmosphere model. 3 In order to determine the altitude error for a given pressure error without double book- 
ing errors induced by this conversion to altitude, it is necessary to use partial derivatives of the atmosphere 
model curve fit to convert the pressure error directly to an altitude error. The method is described below. 

An example curve fit of altitude as a function of the natural log of pressure is shown in Figure 5 below, 
where x = In (pressure). 



Figure 5: Curve fit of 1976 US Standard Atmosphere model. Altitude is expressed as a function of the 
natural log of pressure. 


This curve fit and a reverse curve fit that gives the natural log of pressure as a function of altitude are 
both needed for the calculation of altitude errors from pressure errors. The curves shown here are both valid 
up to approximately 60,000 m, or 197,000 feet. 

The derivative of the curve shown in Figure 5 with respect to ln(pressure) is 

= 5 * 0.390294961 * (ln(p)) 4 - 4 * 21.253672699 * (ln(p)) 3 + 

a(ln(p)) 

3 * 379.25912989 * (ln(p)) 2 - 2 * 2811.855156129 * (In (p) + 1316.306548799 (5) 

Therefore the change in altitude is equal to the change in pressure multiplied by the above equation, where 
ln(p) in the above equation is first calculated using a reverse curve fit that defines ln(p) as a function of 
altitude. This curve fit is: 

ln(p) = 11.5272913 - 0.00011506143a - 2.54388769e" 9 a 2 
+5.88892511e _14 a 3 - 3, 37942857e" 19 a 4 - 9.18098698e" 25 a 5 (6) 

All of these calculations must be performed for a known altitude and a known pressure error. The process 
of calculating the altitude error based on pressure error at a given altitude using Standard76 partials is as 
follows: 

1. Calculate ln(p) using the equation for ln(p) above for a known altitude 

2. Calculate pressure p = exp(ln(p)) 
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3. Calculate d&) usin s ( 5 ) 

4. Compute the two d(ln(p)) terms using In (p) from (6), the pressure from step 2, and the known pressure 
error, p error 

^( ln (p))l = In (p + Perror) - ln(p) 
d(ln(p)) 2 = ln(p - Perror) - ln(p) 

5. Calculate the altitude error 

= l ('rfisffli * <i(1 " (!,))i1 + 'so 

This altitude error is independent of the atmosphere modeling errors discussed previously. 


( 7 ) 

(8) 


V.B. Sensor Errors 

The barometric altimeter specification sheet lists the maximum barometric altimeter error as 0.09% full-scale 
(FS). The barometric altimeters for EFT-1 will output 0.1 V at vacuum, and 5 V at the maximum sensed 
pressure of 20 psi. The full scale sensed pressure range is 0 to 20 psi. In terms of voltage the full scale error 
translates into 0.0041 V, and to 0.018 psi in terms of pressure. 

The sensor errors at each altitude of interest were calculated using the known sensor error of 0.018 psi 
and the method above. The altitude error due to sensor errors is shown in Table 1. 

Table 1: Altitude error due to sensor errors 


LRS Event 

Nominal 

Altitude 

(ft) 

Error (ft) 

- 

55,000 

278 

- 

50,000 

220 

- 

45,000 

176 

Start Smart FBC Jettison Logic 

35,000 

114 

FBC Chute Deploy 

24,000 

74 

Start Drogue Rate Damping 

20,000 

63 

Main Chute Deploy 

8,000 

42 

Start Roll Control 

1,500 

34 

Touchdown 

0 

32 


The sensor errors are zero-mean, so biases due to sensor errors can result in sensed pressures higher or 
lower than truth pressure. 

V.C. A/D Conversion Errors 

The barometric altimeters output an analog voltage signal. This signal is converted to a digital value by the 
Power and Data Unit (PDU) Analog/Digital Input/Output (ADIO) cards. The analog to digital conversion 
in the ADIO card has a spec error of 1% FS. The input voltage range for the A/D conversion is 6 V, which 
equates to an error of 0.06 V or 0.2 psi. The A/D error is expected to manifest as a bias. 

The A/D conversion error was calculated at each altitude of interest. The results are shown in Table 2. 
The A/D conversion error can bias the sensed pressure to be either higher or lower than truth pressure. 

V.D. Aerodynamic Effects 

Given the location of the barometric altimeters, the sensed pressure will be affected by the dynamic conditions 
present during vehicle re-entry. These errors are all lumped together under the category of aerodynamic 
errors. There are three separate contributions to the total aerodynamic error at the barometric altimeter 
assembly: 
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Table 2: Altitude error due to A/D conversion errors 


LRS Event 

Nominal 

Altitude 

(ft) 

Error (ft) 

- 

55,000 

3,116 

- 

50,000 

2,446 

- 

45,000 

1,965 

Start Smart FBC Jettison Logic 

35,000 

1,273 

FBC Chute Deploy 

24,000 

818 

Start Drogue Rate Damping 

20,000 

703 

Main Chute Deploy 

8,000 

462 

Start Roll Control 

1,500 

377 

Touchdown 

0 

361 


1. Steady wake effects resulting in a pressure differential between midbay compartment F and the free 
stream 

2. Oscillating wake effects 

3. Acoustic effects 

The GNC team coordinated with the aerosciences team to create models of these effects. The models 
were based on an analysis and wind tunnel testing performed by Lockheed Martin Space Systems Company 
(LMSSC) Orion Aerosciences and LMSSC Loads and Dynamics. There are three key limitations of the 
aerodynamic models: 

1. CM RCS jet interaction was neglected pending future assessment by the aerosciences team 

2. Supersonic data for the CM oscillating wake pressure model was sparse 

3. Aerodynamic effects are not explicitly correlated to vehicle attitude 

At the time of this document’s writing, the RCS jet interaction models were still being developed. The sparse- 
ness of supersonic wake data was not a driving limitation given the low Mach values under the parachutes. 
From a GNC perspective, the lack of correlation to vehicle attitude was the major limitation. The aerody- 
namic errors were only defined over specific attitude ranges, some of which were exceeded in certain scenarios. 
Work is ongoing to create models correlating aerodynamic effects to vehicle attitude. 

V.D.l. Steady Wake Effects Model 

The steady wake pressure model (also referred to as the CM compartment pressure model) used the standard 
set of EFT-1 dispersed trajectories, the jEXPLAIN ACRONYM^ CAP aerodynamic loads database, and 
variable discharge coefficients generated using Computational Fluid Dynamics (CFD) to assess the altitude- 
dependent pressure inside midbay compartment F, where the barometric altimeters are located. Conservative 
assumptions were made on model uncertainties. 5 The model is a table look-up of the difference between 
compartment pressure and the free stream pressure at a given altitude. It is valid down to altitudes of around 
24,000 feet. There are minimum and maximum bounding cases for two different crew module masses: 20200 
lbm and 23000 lbm. 

Below 24000 feet, a table of coefficient of pressure vs. Mach is used to model the pressure differential. 
This model has a minimum and maximum bounding case, but no mass dependencies. Therefore the same 
values are used for each bounding case regardless of vehicle mass. 


9 of 20 


American Institute of Aeronautics and Astronautics 


V.D.2. Oscillating Wake Effects Model 

The oscillating wake pressure model was derived from results of the 05-CA wind tunnel test. The results 
were spot-checked by CFD/LES simulation of the CM in free-stream (additional CFD/DES cases pending 
by AR-135). 5 Those data will be reviewed based on upcoming 89-CA wind tunnel testing. The oscillating 
wake model provides a Mach-dependent frequency plus an amplitude based on free-stream dynamic pressure. 
The model is valid below 100,000 feet. 

V.D.3. Acoustic Effects Model 

The acoustics model was provided by Loads and Dynamics using entry aerodynamic environments adjusted 
for CM compartment effects. 5 The model simply contains 36 seconds of acoustics data. A frequency spectrum 
analysis revealed the signal is a 60 Hz sinusoid with pink noise and white noise. The original signal was 
sampled at a very high rate; the GNC simulation uses 2.5 seconds of this signal sampled at 200 Hz because 
of array size limitations. The loads and dynamics teams has confirmed looping through the signal is an 
appropriate way to include acoustic effects. The model is valid below 100,000 feet. 

The models discussed above were implemented in the GNC Osiris simulation. Osiris is a Trick-based 
simulation that models sensors, effectors, environments, and vehicle dynamics. The Osiris simulation drives 
a separate standalone simulation containing prototype flight software. In conjunction, the two simulations 
are used to analyzed vehicle state and performance during all mission phases. 

The implementation of the aerodynamic error models in the Osiris simulation is described in detail in 
the Osiris pressure sensor model document. 6 Note that these models are completely decoupled from vehicle 
attitude. Each of the three aerodynamic error models can be enabled and disabled individually. 

Monte Carlo sets were run for all four bounding cases in the Osiris-Ramses simulation to define the worst 
case aerodynamic errors: 

1. Minimum mass, minimum compartment pressure differential model 

2. Maximum mass, minimum compartment pressure differential model 

3. Minimum mass, maximum compartment pressure differential model 

4. Maximum mass, maximum compartment pressure differential model 

All other error sources impacting the sensed pressure were disabled during these runs. The mean, maximum, 
and minimum total error in sensed pressure over all runs in each of the four sets of Monte Carlo runs were 
calculated. These were then converted to altitude errors using the method discussed above. Figure 6 below 
shows the altitude error versus truth geodetic altitude in feet for all four bounding cases. The altitude error 
is defined as the ‘truth 1 altitude from the Osiris simulation minus the altitude output from the barometric 
altimeter flight software. 

From Figure 6, it can be seen that aerodynamic effects generally bias pressure low (truth minus sensed 
pressure almost always positive), which translates into a higher sensed altitude than truth altitude. These 
errors are not zero-mean, and the upper and lower bounds on the error are shown in the plot. 

When converted to an altitude error, the pressure error at each altitude of interest based on this data 
results in the bounding altitude errors shown in Table 3. 

A negative sign indicates the sensed altitude is higher than the truth altitude. As seen in Figure 6, the 
aerodynamic errors nearly always bias the altitude high. This will result in LRS events occurring at lower 
altitudes than nominally planned. The impacts of this are discussed later. 

V.E. Atmospheric Modeling Errors 

The barometric altimeter FSW converts measured pressure to altitude using an extended 1976 US Standard 
Atmosphere model. The model is valid up to 232,000 feet. Any measured pressure less than the Standard76 
model pressure at this altitude results in the maximum altitude of 232,000 feet. The 1976 US Standard 
Atmosphere model is an idealized, steady-state representation of the earth’s atmosphere; on any given flight 
day, the actual atmosphere may differ significantly from the model. 

For verification purposes, the GRAM2007 4 atmosphere model is considered to represent the truth at- 
mosphere on a given flight day. Therefore, error resulting from the use of the Standard model instead of 
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Figure 6: Altitude error due to aerodynamic effects 


using GRAM2007 to convert pressure to altitude in the flight software must be included in the altitude error 
budget. 

To estimate the errors due to use of the Standard76 model in flight software as opposed to using a curve 
fit or other implementation of GRAM, a Monte Carlo set was run using the Osiris-Ramses simulation. The 
GRAM month was dispersed for these runs, as were all of the standard GRAM parameters, but no other 
error sources were enabled. Therefore the sensed pressure was perfect. The difference between the altitude 
calculated from the perfect sensed pressure and the truth altitude from the simulation represents the error 
induced by use of the Standard 76 Atmosphere model to perform the conversion from pressure to altitude 
in the barometric altimeter FSW. The mean, minimum, and maximum altitude errors over the full set of 
Monte Carlo runs is shown in Figure 7. 

The minimum and maximum bounding errors at the altitudes of interest are shown in Table 4. 

As with the aerodynamic errors, the atmospheric modeling errors almost always bias the sensed pressure 
in a specific direction. In general, the altitude from GRAM2007 is generally higher than the altitude from 
the 1976 US Standard Atmosphere model. 


Table 3: Altitude error due to aerodynamic effects 


LRS Event 

Nominal 

Altitude 

(ft) 

Minimum 
Error (ft) 

Maximum 
Error (ft) 

- 

55,000 

-12,928 

-2,774 

- 

50,000 

-8,222 

-2,369 

- 

45,000 

-6,596 

-2,186 

Start Smart FBC Jettison Logic 

35,000 

-4,462 

-1,702 

FBC Chute Deploy 

24,000 

-2,845 

-1,611 

Start Drogue Rate Damping 

20,000 

-1,284 

-452 

Main Chute Deploy 

8,000 

-507 

-133 

Start Roll Control 

1,500 

-19 

7 

Touchdown 

0 

-18 

19 
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Average altitude difference between truth and std76 (baro output) - Atmosphere modeling effects 



Altitude in feet 


Figure 7: Difference between ‘truth 1 altitude and sensed altitude. No error sources affecting sensed pressure 
were enabled in these runs, so this error is solely due to the differences between GRAM2007 and the 1976 
US Standard Atmosphere model. 


It should be noted that, while GRAM2007 is considered the ‘truth 1 atmospheric model throughout this 
paper, there is no guarantee that GRAM will match the actual conditions on the day of flight any better 
than the 1976 US Standard Atmosphere model. This is the case even if the GRAM RRA option is enabled 
to enhance GRAM’s predictive capabilities. 

V.F. Latency 

A total end-to-end latency of 100 ms is budgeted to the barometric altimeters. The altitude errors resulting 
from the 100 ms latency is shown in Table 5. The altitude rate of change values were estimated from Monte 
Carlo runs for a nominal re-entry. 

The latency will always bias the sensed altitude higher than truth altitude, hence the negative signs in 
the altitude error column of the table. 

V.G. Waves and Tides 

Although their impact is slight, waves and tides can also contribute to errors in altitude derived from the 
barometric altimeters. These errors are estimated to be approximately ±14 feet. This value is independent 
of altitude. Wave and tide errors are zero-mean, so biases in sensed pressures resulting from waves and tides 
can be higher or lower than truth pressure. 
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Table 4: Altitude error due to atmospheric effects 


LRS Event 

Nominal 

Altitude 

(ft) 

Minimum 
Error (ft) 

Maximum 
Error (ft) 

- 

55,000 

525 

2,511 

- 

50,000 

864 

3,034 

- 

45,000 

997 

3,250 

Start Smart FBC Jettison Logic 

35,000 

891 

2,759 

FBC Chute Deploy 

24,000 

615 

1,830 

Start Drogue Rate Damping 

20,000 

552 

1,491 

Main Chute Deploy 

8,000 

165 

585 

Start Roll Control 

1,500 

-82 

287 

Touchdown 

0 

5 

262 


Table 5: Altitude error due to latencies 


LRS Event 

Nominal 

Altitude 

(ft) 

Altitude 
Rate of 
Change 
(ft) 

Altitude 
Error (ft) 

- 

55,000 

600 

-60 

- 

50,000 

600 

-60 

- 

45,000 

600 

-60 

Start Smart FBC Jettison Logic 

35,000 

600 

-60 

FBC Chute Deploy 

24,000 

600 

-60 

Start Drogue Rate Damping 

20,000 

200 

-20 

Main Chute Deploy 

8,000 

200 

-20 

Start Roll Control 

1,500 

38 

-4 

Touchdown 

0 

38 

-4 
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V.H. Itemized Error Budget Results 


For a traditional itemized error budget, at this point all of the individual error sources would be combined 
using Equation (4). However, given the directionality inherent to some of the error sources, this method 
was not appropriate. Therefore, the error sources without inherent directionality were combined using 
Equation (4), then the remaining three directional error sources with their signs intact were added to that 
value. The resulting total error budget is shown in Table 6. 

Table 6: Itemized barometric altimeter altitude error budget 


Nominal Minimum Maximum 

LRS Event Altitude Bounding Bounding 

(ft) Error (ft) Error (ft) 


- 

55,000 

-15,607 

2,790 

- 

50,000 

-9,909 

1.965 

- 

45,000 

-7,647 

2,961 

Start Smart FBC Jettison Logic 

35,000 

-4,925 

2,260 

FBC Chute Deploy 

24,000 

-3,127 

965 

Start Drogue Rate Damping 

20,000 

-1,473 

1,709 

Main Chute Deploy 

8,000 

-842 

881 

Start Roll Control 

1,500 

-499 

653 

Touchdown 

0 

-395 

624 


VI. Monte Carlo Simulation 

A Monte Carlo analysis with all of the error sources discussed in the previous sections enabled was run to 
provide validation of the itemized error budget. For the Monte Carlo simulation, the sensor error included 
both noise and bias components. The A/D conversion error was modeled as a random bias. The results of 
the analysis are shown in Table 7. 


Table 7: Barometric altimeter altitude error budget 


LRS Event 

Nominal 

Altitude 

(ft) 

Minimum 
Bounding 
Error (ft) 

Maximum 
Bounding 
Error (ft) 

- 

55,000 

-20,295 

2,004 

- 

50,000 

-11,340 

2,065 

- 

45,000 

-7,908 

2,242 

Start Smart FBC Jettison Logic 

35,000 

-4,263 

1,752 

FBC Chute Deploy 

24,000 

-2,677 

1,146 

Start Drogue Rate Damping 

20,000 

-881 

1,557 

Main Chute Deploy 

8,000 

-612 

868 

Start Roll Control 

1,500 

-409 

670 

Touchdown 

0 

-425 

191 


It is clear from Tables 6 and 7 that, compared to the full Monte Carlo analysis with all interactions between 
error sources modeled, the itemized budget underestimates the errors at higher altitudes and overestimates 
them at lower altitudes. The reason for this discrepancy lies in the violation of one of the underlying 
assumptions made in the construction of the itemized error budget: error source independence. 

It should be obvious from previous sections that the atmospheric modeling errors are not independent 
of the other error sources. The error incurred from atmospheric modeling directly depends on the sensed 
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pressure, which is in turn affected by all of the other error sources. Therefore an independent quantification 
of atmospheric modeling errors is not possible. The Monte Carlo analysis modeled this interaction between 
the error sources, and thus provides the more accurate representation of the overall error budget. 

VII. Impacts of the Barometric Altimeter Error Budget on Design of the LRS 

Event Trigger Altitudes 

As stated previously, one of the purposes of quantifying the errors in the altitude derived from the 
barometric altimeters was to determine whether LRS events triggered from that altitude would occur within 
acceptable altitude ranges. Therefore it is important to to determine the truth altitude at which each event 
would occur given worst case barometric altimeter errors. For example, barometric altimeters consistently 
reading low could estimate the altitude to be 35,000 feet at a truth altitude of 36,615 ft. Table 8 shows how 
this calculation was performed. 

Table 8: Determining Truth Altitude Range Within Which Smart FBC Jettison Logic Will Start 


Truth 

Altitude (ft) 

Baro 
Error 
Max (ft) 

Baro 
Error 
Min (ft) 

Baro 
Altitude 
Low (ft) 

Baro 
Altitude 
High (ft) 

37,000 

1,669 

-4,748 

35,331 

41,478 

36,500 

1,599 

-4,693 

34,901 

41,193 

36,000 

1,578 

-4,583 

34,422 

40,583 

35,500 

1,580 

-4,342 

33,920 

39,842 

35,000 

1,572 

-4,263 

33,420 

39,263 

34,500 

1,533 

-4,185 

32,928 

38,685 

34,000 

1,546 

-4,003 

32,467 

38,003 

33,500 

1,450 

-3,983 

31,954 

37,483 

33,000 

1,464 

-3,983 

31,454 

36,983 

32,500 

1,331 

-3,885 

31,050 

36,385 

32,000 

1,290 

-3,762 

30,536 

35,762 

31,500 

1,290 

-3,762 

30,036 

35,262 

31,000 

1,299 

-3,563 

29,670 

34,563 


For each truth altitude in the left-most column, the minimum and maximum bounding errors at that 
altitude (columns 2 and 3) were subtracted from it to calculate the values the barometric altimeters could 
output at that truth altitude given the expected errors at that altitude. The values the barometric altimeters 
would output are shown in columns 4 and 5. If the barometric a.ltj — ~ers are reading high (minimum 
bounding error), the FSW altitude will be the value shown in column (f — jthey are reading low (maximum 
bounding error), the FSW altitude will be the value shown in column SVxncrefore, the Smart FBC jettison 
logic could be started at truth altitudes between 36,615 feet and 31,312 feet. These values were obtained 
by performing linear interpolation of the highlighted cells in Table 8 to find the truth altitude at which the 
barometric altimeters would output the start of Smart FBC jettison logic trigger altitude of 35,000 feet. 

Repeating this exercise for all of the EDL events triggered based on FSw altitude yields the true altitude 
ranges at which each event would occur with the current altitude trigger settings. These values are shown 
in Table 9. 

As seen in the first row of Table 9, smart FBC jettison logic start might occur 115 feet higher than the 
desired maximum altitude of 36,500 feet with the target trigger altitude set to 35,000 feet, but all other 
events will occur well within their allowable ranges if the source of the FSW altitude is the barometric 
altimeters. The 115 foot excess over margin was deemed acceptable for the Smart FBC jettison logic. Also 
note there is no overlap of the ranges at which the various events could occur, so if for any reason the 
barometric altimeters were to oscillate between the high and low error bounds, all events would still occur 
within acceptable ranges. 

An alternate approach could have been taken had the bounds for the EDL events been defined, but the 
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Table 9: Truth Altitude Ranges Within Which Altitude-Triggered EDL Events Will Occur 


LRS Event 

Targeted 

Altitude 

(ft) 

Maximum 

Altitude 

(ft) 

Minimum 

Altitude 

(ft) 

Maximum 
Alt Baro 
(ft) 

Minimum 
Alt Baro 
(ft) 

Smart FBC Jettison Logic Start 

35,000 

36,500 

30,000 

36,615 

31,312 

FBC Parachute Deployment 

33,500 

36,500 

20,500 

25,109 

22,084 

Drogue Chute Release Ceiling 

8,000 

9,500 

5,000 

8,933 

7,238 

Drogue Chute Release Floor 

8,000 

9,500 

5,000 

8,933 

7,238 

Landing Orient Mode Initiation 

1,500 

2,500 

1,000 

2,210 

1,070 


goal was to determine the target altitudes. To define the allowable range of each trigger, the barometric 
altimeter altitude errors at the known upper and lower bounds for each event could have been added to 
the bounding altitudes to compute where the triggers should be set. Figure 8 shows how this would be 
accomplished. 
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Upper Bound Altitude 


Altitude Trigger Range 




minus error 


“plus” error (trigger high) 


Lower Bound Altitude 

> 

“plus” error 


Figure 8: Using the Barometric Altimeter Altitude Budget to Define EDL Trigger Ranges 


17 of 20 


American Institute of Aeronautics and Astronautics 






VIII. Defining Maximum Altitude at which Barometric Altimeters are Valid 

The secondary purpose of characterizing the barometric altimeter altitude errors was to determine at 
which point the errors become small enough to allow use of the sensors. Figures 9 and 10 show the total 
altitude errors at 500 foot intervals. 
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Figure 9: Barometric altimeter altitude errors at 500 foot intervals 


The linear large altitude error trend in Figure 9 is an artifact of how negative and very small voltages 
are handled in the flight software. Due to noise, sensor errors, and A/D conversion errors, the voltage from 
the barometric altimeters read by the FSW can be less than the spec minimum value of 0.1 V. Any voltage 
representing a pressure less than the minimum pressure at which the FSW model can convert pressure to 
altitude results in an altitude output of the maximum model altitude from the flight software. This causes 
the linear trend seen between 100,000 and 65,000 feet in Figure 9. 

All of the LRS events occur in the lower altitude range shown in Figure 10. There is a knee in the altitude 
error curves at around 50,000 feet in the figure, after which altitude errors decrease rapidly. Therefore, 
barometric altimeter altitude should not be used at truth altitudes higher than 50,000 feet. Based on 
the error budget, a truth altitude of 50,000 feet corresponds to a calculated altitude of 61,340 feet. The 
barometric altimeter flight software contains a gate that only allows use of the barometric altimeter altitude 
once the barometric altimeter altitude is less than the gate altitude threshold. 

However, although the barometric altimeter altitude errors become very large at sensed altitudes of higher 
than 61,340 feet, there is another factor that drives the setting of the barometric altimeter gate. The tertiary 
backup to GPS and barometric altitude is a velocity trigger based on the unaided navigation solution. The 
velocity trigger is discussed above. The setting for this trigger can result in FBC chute deployment at very 
high altitudes, so if GPS data is unavailable and the barometric altimeter gate is set too low, the velocity 
trigger can cause the drogue chutes to be deployed at too high an altitude. 
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Figure 10: Barometric altimeter altitude errors at 500 foot intervals from sea level up to 55,000 feet 


Given that, it was decided to set the barometric altimeter gate to 70,000 feet. The reason for this is 
that, if the barometric altimeters are reading high, FBC jettison will not be triggered too early even if the 
barometric altimeter altitude is considered valid while errors are still very large. 
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IX. Conclusion 


The initial attempt to characterize the altitude error budget for the EFT-1 barometric altimeters using 
the typical itemized error budget approach was stymied by lack of independence between error sources. 
Therefore a full Monte Carlo simulation with all error sources and their interactions enabled was performed 
to define the altitude error budget. The resulting errors drove the decision to move the trigger altitude for 
FBC parachute deployment to a higher altitude in order to ensure drogue parachute deployment occurred 
above the minimum allowable altitude. The barometric altimeter errors are very large above an altitude of 
50,000 feet; therefore the barometric altimeter flight software employs a gate to prevent use of altitude from 
the barometric altimeters above a certain altitude. 
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